---
title: "Create an entity context sync configuration"
method: POST
path: "/api/v2/security_monitoring/configuration/integration_config"
tags: ["Security Monitoring"]
---

# Create an entity context sync configuration

`POST /api/v2/security_monitoring/configuration/integration_config`

Create a new entity context sync configuration so Cloud SIEM can ingest entities from an external
source. The credentials provided in `secrets` are validated against the source before the configuration
is stored and never returned in subsequent responses.

## Request body

- SecurityMonitoringIntegrationConfigCreateRequest — Request body to create an entity context sync configuration.
  - `data` SecurityMonitoringIntegrationConfigCreateData, required — The entity context sync configuration to create.
    - `attributes` SecurityMonitoringIntegrationConfigCreateAttributes, required — The attributes of the entity context sync configuration to create.
      - `domain` string, required — The domain associated with the external entity source.
      - `integration_type` 'GOOGLE_WORKSPACE' | 'OKTA' | 'ENTRA_ID', required — The type of external source that provides entities to Cloud SIEM.
      - `name` string, required — The display name for the entity context sync configuration.
      - `secrets` SecurityMonitoringIntegrationConfigSecrets — The secrets used to authenticate against the external entity source. The accepted keys depend on the source type (for example, `admin_email` for Google Workspace). Not required for source types that do not use secrets (for example, `ENTRA_ID`).
      - `settings` SecurityMonitoringIntegrationConfigSettings — Free-form, non-sensitive settings for the entity context sync. The accepted keys depend on the source type.
    - `type` 'integration_config', required — The type of the resource. The value should always be `integration_config`.

## Response `200`

OK

- SecurityMonitoringIntegrationConfigResponse — Response containing a single entity context sync configuration.
  - `data` SecurityMonitoringIntegrationConfigData, required — An entity context sync configuration.
    - `attributes` SecurityMonitoringIntegrationConfigAttributes, required — The attributes of an entity context sync configuration as returned by the API.
      - `created_at` string, date-time — The time at which the entity context sync configuration was created.
      - `domain` string, required — The domain associated with the external entity source (for example, the customer's identity provider domain).
      - `enabled` boolean, required — Whether the sync is enabled and actively ingesting entities into Cloud SIEM.
      - `integration_type` 'GOOGLE_WORKSPACE' | 'OKTA' | 'ENTRA_ID', required — The type of external source that provides entities to Cloud SIEM.
      - `modified_at` string, date-time — The time at which the entity context sync configuration was last modified.
      - `name` string — The display name of the entity context sync configuration.
      - `settings` SecurityMonitoringIntegrationConfigSettings — Free-form, non-sensitive settings for the entity context sync. The accepted keys depend on the source type.
      - `state` 'valid' | 'invalid' | 'initializing' — The state of the credentials configured on the entity context sync.
    - `id` string, required — The unique identifier of the integration configuration.
    - `type` 'integration_config', required — The type of the resource. The value should always be `integration_config`.

## Other responses

- `400` — Bad Request
- `403` — Not Authorized
- `429` — Too many requests

---

[API](https://skmtc.dev/datadog/apis/api-v2.md) · [All operations](https://skmtc.dev/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)